Environment variable reference

This page lists the environment variables read directly by the Registry Notary binary, the Registry Relay binary, and registryctl. These are fixed variable names that the process resolves itself.

Secret material such as credential hashes, signing keys, and upstream tokens is not read from a fixed variable name. Instead, each config field names the environment variable to read, and the operator chooses the name. Those per-deployment variables are documented in the synced configuration references rather than repeated on this page. See the Registry Notary operator config reference and the Registry Relay configuration reference for the config fields that name secret environment variables.

Configuration expansion

Registry Notary and Registry Relay expand ${VAR} expressions before YAML parsing. ${VAR} requires VAR to be set to a non-empty value. ${VAR:-fallback} uses fallback when VAR is unset or empty, including ${VAR:-} for an explicit empty result. ${VAR:?message} fails with message when VAR is unset or empty. Whitespace-only values are non-empty. Diagnostics name the variable or use the supplied message; they never include the variable value.

Registry Notary

The Registry Notary binary reads the variables below. Each also has an equivalent command-line flag.

Name	Purpose	Default or required
REGISTRY_NOTARY_CONFIG	YAML config path. Equivalent to --config.	Required for commands that load config.
REGISTRY_NOTARY_ENV_FILE	Dotenv-style file to load before config validation resolves env vars. Equivalent to --env-file.	Optional.
REGISTRY_NOTARY_BIND	Override server.bind after config load. Equivalent to --bind.	Optional.
REGISTRY_NOTARY_HEALTHCHECK_URL	Health endpoint URL for the healthcheck command.	Defaults to http://127.0.0.1:8080/healthz.
REGISTRY_NOTARY_HEALTHCHECK_TIMEOUT_MS	Health probe timeout in milliseconds for the healthcheck command.	Defaults to 5000.
REGISTRY_NOTARY_LOG_FORMAT	Operational log format: text or json.	Defaults to text.

Registry Relay

The Registry Relay binary reads the variables below.

Name	Purpose	Default or required
REGISTRY_RELAY_CONFIG	YAML config path used when --config is not passed.	Falls back to ./config/example.yaml.
REGISTRY_RELAY_ENV_FILE	Dotenv-style file to load before config validation resolves env vars, used when --env-file is not passed.	Optional.
REGISTRY_RELAY_BIND	Override server.bind.	Optional.
REGISTRY_RELAY_LOG_FORMAT	Operational log format: json or jsonl select JSON output; any other value selects text.	Defaults to text.
DATA_GATE_POSTGRES_ROOT_CERT_PATH	Path to a PEM file with a custom root certificate to trust for a Postgres source connector’s TLS connection.	Optional. Falls back to the system default trust store when unset.

The audit hash secret and other secret material are read from operator-named variables declared in config fields such as audit.hash_secret_env (for example, REGISTRY_RELAY_AUDIT_HASH_SECRET), API key fingerprint env names, and the Postgres connection_env. For the full list of config fields that name secret environment variables, see the Registry Relay configuration reference.

registryctl

registryctl reads the variables below. Registry Stack projects bind source and credential values through operator-selected secret references in environment files; the authored project and generated inputs contain the reference names, not the secret values.

Name	Purpose	Default or required
REGISTRYCTL_NO_UPDATE_CHECK	Disable the automatic update check when set to a non-empty value other than 0 or false.	Optional.
REGISTRYCTL_UPDATE_CHECK	Disable the automatic update check when set to 0 or false.	Optional.
REGISTRYCTL_VERSION	Pinned release the installer downloads. Read by the install script, not the running binary.	Defaults to the installer’s pinned release.
CI	When set to a non-empty value other than 0 or false, disables the automatic update check.	Optional.

Source

The fixed variable names above are transcribed from the binaries and the registryctl source. For the canonical definitions, read the Registry Notary binary entry point, the Registry Relay binary entry point, and the registryctl library source. The operator-named secret variables are documented in the Registry Notary operator config reference and the Registry Relay configuration reference.